google vulnerabilities

Recent CVEs affecting google products. 383 tracked.

google has 383 tracked vulnerabilities, 58 critical and 3 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 381. Most recent: 2026-10-20. Highest priority: CVE-2026-85046 (score 86/100).

• CVE-2026-17801 CRITICAL 9.6 UPGRADE Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to pot
• CVE-2026-14537 CRITICAL 9.8 DOWNGRADE Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0
• CVE-2026-17881 HIGH 8.8 UPGRADE Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitra
• CVE-2026-17847 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17768 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a rem
• CVE-2026-17803 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a
• CVE-2026-17804 CRITICAL 9.6 UPGRADE Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17832 CRITICAL 9.6 UPGRADE Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17834 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remo
• CVE-2026-17837 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remot
• CVE-2026-17848 CRITICAL 9.6 UPGRADE Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially pe
• CVE-2026-17856 CRITICAL 9.6 UPGRADE Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17865 CRITICAL 9.6 UPGRADE Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacke
• CVE-2026-17778 HIGH 8.8 UPGRADE Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbi
• CVE-2026-17807 HIGH 8.8 UPGRADE Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co
• CVE-2026-17836 HIGH 8.8 UPGRADE Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co
• CVE-2026-17875 HIGH 8.8 UPGRADE Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrar
• CVE-2026-17784 HIGH 8.8 UPGRADE Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compr
• CVE-2026-17855 CRITICAL 9.6 UPGRADE Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17884 HIGH 8.8 UPGRADE Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentia
• CVE-2026-17886 HIGH 8.8 UPGRADE Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially
• CVE-2026-17868 HIGH 8.8 UPGRADE Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to pe
• CVE-2026-17786 HIGH 8.8 UPGRADE Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed an atta
• CVE-2026-17877 HIGH 8.4 UPGRADE Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local at
• CVE-2026-14539 HIGH 7.5 UPGRADE An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox ve
• CVE-2026-14541 HIGH 7.5 DOWNGRADE An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of
• CVE-2026-17869 HIGH 8.1 UPGRADE Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an ou
• CVE-2026-17887 HIGH 7.5 UPGRADE Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a u
• CVE-2026-17816 HIGH 7.5 UPGRADE Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote
• CVE-2026-17796 MEDIUM 6.5 UPGRADE Side-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17800 MEDIUM 6.5 UPGRADE Inappropriate implementation in MediaRecording in Google Chrome prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-14538 HIGH 7.7 UPGRADE An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool componen
• CVE-2026-17764 MEDIUM 6.5 UPGRADE Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to byp
• CVE-2026-17774 HIGH 7.5 UPGRADE Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an at
• CVE-2026-17791 MEDIUM 6.5 UPGRADE Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remot
• CVE-2026-17792 MEDIUM 6.5 UPGRADE Inappropriate implementation in Credential Management in Google Chrome prior to 151.0.7922.72 allowed a remote
• CVE-2026-17793 MEDIUM 6.5 UPGRADE Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17805 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17811 HIGH 7.1 UPGRADE Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potent
• CVE-2026-17813 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a rem
• CVE-2026-17814 MEDIUM 6.5 UPGRADE Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 al
• CVE-2026-17819 MEDIUM 6.5 UPGRADE Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17824 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-17825 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remo
• CVE-2026-17828 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17830 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17831 MEDIUM 6.5 UPGRADE Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remo
• CVE-2026-17835 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17838 MEDIUM 6.5 UPGRADE Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17839 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17840 MEDIUM 6.5 UPGRADE Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perfor
• CVE-2026-17861 HIGH 7.8 UPGRADE Insufficient validation of untrusted input in Updater in Google Chrome prior to 151.0.7922.72 allowed a local
• CVE-2026-17862 HIGH 7.8 UPGRADE Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perfo
• CVE-2026-17863 HIGH 7.8 UPGRADE Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local att
• CVE-2026-17864 HIGH 7.8 UPGRADE Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacke
• CVE-2026-17867 HIGH 7.1 UPGRADE Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17873 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a rem
• CVE-2026-17888 HIGH 7.1 UPGRADE Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17789 MEDIUM 6.5 UPGRADE Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 al
• CVE-2026-17787 MEDIUM 6.5 UPGRADE Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17821 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who
• CVE-2026-17822 MEDIUM 6.5 UPGRADE Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI
• CVE-2026-17823 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17841 MEDIUM 6.5 UPGRADE Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI
• CVE-2026-17842 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17846 MEDIUM 6.5 UPGRADE Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-17850 MEDIUM 6.5 UPGRADE Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17852 MEDIUM 6.5 UPGRADE Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17854 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17882 MEDIUM 6.5 UPGRADE Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user t
• CVE-2026-17883 MEDIUM 6.5 UPGRADE Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17780 MEDIUM 6.3 UPGRADE Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote att
• CVE-2026-17770 MEDIUM 5.8 UPGRADE Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had c
• CVE-2026-17797 MEDIUM 6.1 UPGRADE Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to injec
• CVE-2026-17818 MEDIUM 6.1 UPGRADE Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to i
• CVE-2026-17827 MEDIUM 6.1 UPGRADE Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to injec
• CVE-2026-17845 MEDIUM 6.1 UPGRADE Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to injec
• CVE-2026-17853 MEDIUM 6.1 UPGRADE Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who
• CVE-2026-17878 MEDIUM 6.1 UPGRADE Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to injec
• CVE-2026-17771 MEDIUM 4.3 UPGRADE Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-orig
• CVE-2026-17779 MEDIUM 5.4 UPGRADE Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17785 MEDIUM 4.3 UPGRADE Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-ori
• CVE-2026-17790 MEDIUM 4.3 UPGRADE Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obt
• CVE-2026-17806 MEDIUM 5.8 UPGRADE Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a rem
• CVE-2026-17809 MEDIUM 5.8 UPGRADE Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a rem
• CVE-2026-17812 MEDIUM 5.4 UPGRADE Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17866 MEDIUM 5.8 UPGRADE Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had com
• CVE-2026-17874 MEDIUM 5.4 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17890 MEDIUM 5.8 UPGRADE Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remot
• CVE-2026-17776 MEDIUM 5.8 UPGRADE Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise
• CVE-2026-17795 MEDIUM 4.3 UPGRADE Inappropriate implementation in GetUserMedia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17799 MEDIUM 5.4 UPGRADE Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a
• CVE-2026-14540 MEDIUM 6.1 UPGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Go
• CVE-2026-10032 MEDIUM 6.1 UPGRADE The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without valida
• CVE-2026-17872 MEDIUM 6.1 UPGRADE Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attack
• CVE-2026-17808 MEDIUM 4.3 UPGRADE Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to lea
• CVE-2026-17810 MEDIUM 4.3 UPGRADE Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-orig
• CVE-2026-17858 MEDIUM 4.3 UPGRADE Uninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to lea
• CVE-2026-17889 MEDIUM 4.3 UPGRADE Uninitialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-ori
• CVE-2026-17767 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allow
• CVE-2026-17769 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17772 MEDIUM 4.3 UPGRADE Out of bounds read in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an ou
• CVE-2026-17773 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17782 MEDIUM 4.3 UPGRADE Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17794 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowe
• CVE-2026-17802 MEDIUM 4.3 UPGRADE Side-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17851 MEDIUM 4.3 UPGRADE Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17859 MEDIUM 4.3 UPGRADE Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17765 MEDIUM 4.3 UPGRADE Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker w
• CVE-2026-17775 MEDIUM 4.3 UPGRADE Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attac
• CVE-2026-17777 MEDIUM 4.3 UPGRADE Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17783 MEDIUM 4.3 UPGRADE Inappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to le
• CVE-2026-17788 MEDIUM 4.3 UPGRADE Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to lea
• CVE-2026-17798 MEDIUM 4.3 UPGRADE Inappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak
• CVE-2026-17815 MEDIUM 4.3 UPGRADE Insufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17817 MEDIUM 4.3 UPGRADE Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attac
• CVE-2026-17820 MEDIUM 4.3 UPGRADE Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17829 MEDIUM 4.3 UPGRADE Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17833 MEDIUM 4.3 UPGRADE Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17843 MEDIUM 4.3 UPGRADE Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak
• CVE-2026-17849 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17857 MEDIUM 4.3 UPGRADE Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to l
• CVE-2026-17871 MEDIUM 4.3 UPGRADE Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker wh
• CVE-2026-17876 MEDIUM 4.3 UPGRADE Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17879 MEDIUM 4.3 UPGRADE Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17880 MEDIUM 4.3 UPGRADE Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-17885 MEDIUM 4.3 UPGRADE Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to lea
• CVE-2026-17781 MEDIUM 4.3 UPGRADE Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who con
• CVE-2026-17844 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker
• CVE-2026-17870 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker
• CVE-2026-17826 LOW 3.1 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17766 LOW 3.3 UPGRADE Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 all
• CVE-2026-17860 LOW 3.3 UPGRADE Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowe
• CVE-2026-17894 HIGH 8.8 UPGRADE Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentia
• CVE-2026-17922 HIGH 8.8 UPGRADE Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker t
• CVE-2026-17924 CRITICAL 9.6 UPGRADE Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised th
• CVE-2026-17935 HIGH 8.8 UPGRADE Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute ar
• CVE-2026-17940 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.79
• CVE-2026-17947 CRITICAL 9.6 UPGRADE Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially
• CVE-2026-17987 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a
• CVE-2026-17989 HIGH 8.8 UPGRADE Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co
• CVE-2026-17990 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remot
• CVE-2026-17991 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-18002 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a re
• CVE-2026-18015 CRITICAL 9.6 UPGRADE Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17918 HIGH 8.8 UPGRADE Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary
• CVE-2026-17956 HIGH 8.8 UPGRADE Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker t
• CVE-2026-17969 HIGH 8.8 UPGRADE Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to
• CVE-2026-18012 HIGH 8.8 UPGRADE Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrar
• CVE-2026-18017 HIGH 8.8 UPGRADE Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary

FAQ

How do I fix google vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is google being exploited right now?

Yes: 3 google CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which google CVE should I patch first?

CVE-2026-85046 currently ranks highest (86/100): Google Chromium V8 Type Confusion Vulnerability.

Products

• a2ui\/web core
• android
• chrome
• mcp toolbox for databases
• v8

← Back to latest CVEs